CVE-2026-65950 in OneCLI
Summary
by MITRE • 11/11/2026
A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted ZIP-based update package.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/11/2026
The identified security flaw resides within the archive extraction subsystem of Lenovo XClarity Essentials OneCLI version 5.5.0 for Linux, specifically affecting its handling of ZIP format files used for system updates and configuration deployments. This vulnerability is classified as a path traversal issue, formally recognized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical deficiency stems from insufficient validation or sanitization of file paths contained within the compressed archive before extraction. When OneCLI processes an update package, it iterates through entries in the ZIP file and writes them to the target directory on the host system without adequately checking whether any entry contains relative path components such as dot-dot-slash sequences that attempt to escape the intended destination folder.
An attacker can exploit this weakness by constructing a maliciously crafted ZIP archive containing files with names designed to traverse upward through the directory hierarchy using standard Unix-style navigation characters. By embedding entries like ../../etc/passwd or similar paths pointing to sensitive system locations, the extraction logic blindly follows these instructions and overwrites critical files outside of the designated update directory. This behavior violates the principle of least privilege and proper input validation, allowing external data to dictate file system operations in an uncontrolled manner. The vulnerability relies on social engineering aspects where a user or administrator is convinced to process this specially crafted ZIP-based update package through the OneCLI interface, effectively bypassing security controls that would normally restrict write access to specific directories.
The operational impact of this path traversal flaw is severe, as it enables arbitrary file write operations with the privileges associated with the running OneCLI process. If the service executes under a privileged account, which is common for system management tools handling firmware and configuration updates, an attacker can overwrite critical system binaries, configuration files, or scripts located in sensitive directories such as /etc, /usr/bin, or other protected areas of the Linux file system. This capability facilitates privilege escalation, persistence mechanisms through backdoor installation, denial of service via corruption of essential components, or further exploitation by chaining with local vulnerability exploits to gain root access. The ability to write arbitrary files essentially grants full control over the affected host's operating environment once the malicious archive is processed.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Lenovo has addressed this issue in subsequent releases of OneCLI, so updating to a patched version that implements robust path canonicalization and validation during ZIP extraction is the primary recommendation. Administrators should ensure that all management tools are kept up-to-date with vendor-provided security patches. Additionally, implementing defense-in-depth measures such as running service processes under restricted user accounts with minimal file system permissions can limit the blast radius of any successful exploitation. Input validation at the application level must enforce strict allow-listing for extracted paths and reject any entry containing relative path traversal sequences before writing to disk. Security awareness training should also be reinforced to prevent users from processing unverified or suspicious update packages, thereby reducing the attack surface associated with social engineering vectors targeting system administration tools.